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IN THE UNITED STATES DISTRICT COURT 
FOR THE NORTHERN DISTRICT OF CALIFORNIA 



) MDLDkt, No. 06-1791-VRW 

J 

) CLASSIFIED DECLARATION 

) OF LT. GEN. KEITH B. 

) ALEXANDER, DIRECTOR, 

) NATIONAL SECURITY 

) AGENCY 

) 

) SUBMITTED IN CAMERA , 

) EX PARTE 

) 

J Hon. Vaughn R. Walker 



IN CAMERA, EX PARTE DECLARATION OF LIEUT AN ANT GENERAL KEITH B. 

ALEXANDER, DIRECTOR, NATIONAL SECURITY AGENCY 

(U) I, Lieutenant General Keith B. Alexander, do hereby state and declare as follows: 

I. (U) Introduction 

1 . (U) I am the Director of the National Security Agency (NSA), an intelligence 
agency within the Department of Defense. 1 am responsible for directing the NSA, overseeing 
the operations undertaken to carry out its mission and, by specific charge of the President and the 
Director of National Intelligence, protecting NSA activities and intelligence sources and 
methods. I have been designated an original TOP SECRET classification authority under 
Executive Order No. 12958, 60 Fed. Reg. 19825 (1995), as amended on March 25, 2003, and 
Department of Defense Directive No. 5200. 1-R, Information Security Program Regulation, 32 
C.F.R. § 159a. 12 (2000). 

2. (U) The purpose of this declaration is to support an assertion of the military and 
state secrets privilege (hereafter “state secrets privilege”) by the Director of National Intelligence 
(DNI) as the head of the intelligence community, as well as the DNI’s assertion of a statutory 
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/TOP//ORCON/NOFORN//MR 
privilege under the National Security Act. Specifically, in the course of my official duties, I 
have been advised of this litigation and the allegations in the Plaintiffs’ complaint. As described 
herein, various classified facts related to the Plaintiffs’ claims are subject to the DNI’s state 
secrets privilege assertion. The disclosure of this information, which relates to NS A intelligence 
information, activities, sources, methods, and relationships, reasonably could be expected to 
cause exceptionally grave damage to the national security of the United States. In addition, it is 
my judgment that sensitive state secrets are so central to the subject matter of the litigation that 
any attempt to proceed in the case risks the disclosure of the secrets described herein and 
exceptionally grave damage to the national security of the United States. Through this 
declaration, I also hereby invoke and assert the NSA’s statutory privilege set forth in section 6 of 
the National Security Agency Act of 1959, Public Law No. 86-36 (codified as a note to 50 USC. 
§ 402) (“NSA Act”), to protect the information related to NSA activities described below. The 
statements made herein are based on my personal knowledge of NSA activities and operations, 
and on information available to me as Director of the NSA. 

II. (U) Summary 

3. ffft¥Sii¥¥SJ¥) j ©©#^HPlaintiffs in this lawsuit allege that the NSA conducts a 
“dragnet” surveillance program involving the interception of “virtually every telephone, internet 
and/or email communication that has been sent from or received within the United States since 
2001 .” Amended Compl. 1 , 4. That allegation is false. As set forth below, there is no such 

“dragnet” program, 

Rather, as I have previously advised the Court, the NSA has conducted targeted 

content surveillance aimed at al Qaeda and affiliated terrorist organizations pursuant to the 

President’s Terrorist Surveillance Program (“TSP”) and recent orders of the Foreign Intelligence 
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Surveillance Court (“FISC” or “FISA Court”). As the Court is also aware, the NSA has 
collected, pursuant to Presidential authorization and subsequent FISC orders, non-content 
information (i.e., meta data) about telephone and Internet communications in order to enable 



| highly sophisticated analytical tools that can uncover the contacts! 

or agents 



I To demonstrate that these or 



other NSA activities do not constitute the dragnet that Plaintiffs allege, however, would require 
the disclosure of highly classified intelligence information, sources, and methods. Indeed, 
although the existence of the TSP has been acknowledged, the details of that program — as well 
as the details of the related content surveillance authorized by the FISC — remain highly 
classified, and the meta data activities have never been acknowledged by the United States and 
likewise remain highly classified. 



4. ( I i 'ii V/ iI I MVMH i' N I'I In addition, Plaintiffs allege that Verizon and 

AT&T have cooperated in the alleged dragnet program. See Amended Compl. TH! 5-8. Neither 
company assisted with the alleged dragnet program, because no such dragnet exists. 



19 the disclosure of 



ould cause exceptionally grave damage to the national security. 

21 5 . P// OC/N F) Accordi ngl y, th e protection of the cl assi fied 

22 information put at risk by this case, including the following is vital to the national security of the 

23 United States: (1) any information that would tend to confirm or deny whether particular 
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1 individuals such as the named Plaintiffs have been subject to any NSA intelligence activities; 

2 (2) information about NSA intelligence activities, including facts demonstrating that the TSP 

3 was limited to al Qaeda-related international communications and was not a content surveillance 

4 dragnet as Plaintiffs allege; (3) facts that would tend to confirm or deny the existence of the 

5 NSA ’s meta data activities, and any information about those activities; and (4) the fact that 

6 Any 

7 disclosure or official confirmation of this information would cause exceptionally grave damage 

8 to the national security. 

9 6. (U) For these reasons, as set forth further below, the state secrets and statutory 

1 0 privilege assertions that the DNI and I are making should be upheld and the information 

1 1 described in this declaration should be protected from disclosure. I also believe that any further 

1 2 litigation of this case poses exceptionally grave risks to the national security. 

13 (U) Table of Contents 

14 7. ( I I MWI M <NI ) In facilitate the Court’s review, this 

1 5 declaration is organized as follows: 

16 I. Introduction 

17 II. Summary 

18 III. Classification of Declaration 

19 IV. Background Information 

20 A. The National Security Agency 

21 B. September 1 1 , 200 1 and the Continuing al Qaeda Threat 

22 V. Information Protected by Privilege 

23 VI. Description of Information Subject to Privilege and the Harm of Disclosure 
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Information That May Tend to Confirm or Deny Whether or Not the Plaintiffs 
Have Been Subject to Any Alleged NSA Activities That May Be at Issue in This 
Matter 

2 . 

3. Harm of Disclosure 

B. Information Concerning NSA Activities, Sources, and Methods, and the Harm of 
Disclosure 

1. Information Concerning Plaintiffs’ Allegations of a Content Surveillance 
“Dragnet” 

2 . Additional Classi fied Information Concerning the TSP 

3. Information Concerning Meta Data Activities 

4. Information Demonstrating the Success of TSP and Meta Data Activities 

5. Information Concerning the FISC Orders 

C. Information That May Tend to Confirm or Deny Whether Verizon/MCI 
and/or AT&T Has AssisterHh^^^with the Alleged Intelligence 
Activities, and the J 

VII. Risks of Allowing Litigation to Proceed 

VIII. Summary and Conclusion 

UI. (U) Classification of Declaration 
8. -fS)-This declaration is classified TOP SECRET//COMINT 
^^^^^^^^^TSP//ORCON/NOFORN//MR pursuant to the standards in Executive Order No. 
12958, as amended by Executive Order No. 13292. Under Executive Order No. 12958, 
information is classified ‘TOP SECRET” if unauthorized disclosure of the information 
reasonably could be expected to cause exceptionally grave damage to the national security of (he 
United States; “SECRET” if unauthorized disclosure of the information reasonably could be 
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TOP 5CCRE riFtfeeMfNT^J^y !: F SP//OIlCON/NOrORN//MR 
expected to cause serious damage to national security; and “CONFIDENTIAL” if unauthorized 
disclosure of the information reasonably could be expected to cause identifiable damage to 
national security. At the beginning of each paragraph of this declaration, the letter or letters in 
parentheses designate(s) the degree of classification of the information the paragraph contains. 
When used for this purpose, the letters “U," “C,” “S,” and *TS” indicate respectively that the 
information is either UNCLASSIFIED, or is classified CONFIDENTIAL, SECRET, or TOP 
SECRET. 1 

9. Additionally, this declaration also contains Sensitive Compartmented 

Information (SCI), which is “information that not only is classified for national security reasons 
as Top Secret, Secret, or Confidential, but also is subject to special access and handling 
requirements because it involves or derives from particularly sensitive intelligence sources and 
methods.” 28 C.F.R. § 17.18(a). Because of the exceptional sensitivity and vulnerability of such 
information, these safeguards and access requirements exceed the access standards that are 
normally required for information of the same classification level. Specifically, this declaration 
references communications intelligence (COM1NT), also referred to as special intelligence (SI), 
which is a subcategory of SCI. COMINT or SI identifies SCI that was derived from exploiting 
cryptographic systems or other protected sources by applying methods or techniques, or from 
intercepted foreign communications. 
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This declaration also contains information 



related to or derived from the Terrorist Surveillance Program (TSP), a controlled access signals 
intelligence program authorized by the President in response to the attacks of September 11, 
2001 . Although the President publicly acknowledged the existence of the TSP in December 
2005, details about the program remain highly classified and strictly compartmented. 



Information pertaining to this program is denoted with the special marking ‘TSP” and requires 
more restrictive handling. I 



1 1 . -fS) In addition to the fact that classified information contained herein may not be 
revealed to any person without authorization pursuant to Executive Order 12958, as amended, 
this declaration contains information that may not be released to foreign governments, foreign 
nationals, or non-U.S. citizens without permission of the originator and in accordance with DNI 
policy. This information is labeled “NOFORN,” The “ORCON” designator means that the 
originator of the information controls to whom it is released. Finally, this document is marked 
Manual Review (“MR”) indicating that it is not subject to automatic declassification at any 
specific date. 
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IV. fUl Background Information 
A. (U) Background on The National Security Agency 

1 2. (U) The NSA was established by Presidential Directive in 1 952 as a separately 
organized agency within the Department of Defense. Under Executive Order 12333, § 1. 12(b), 
as amended, the NSA’s cryptologic mission includes three functions: (1) to collect, process, and 
disseminate signals intelligence (SIGINT) information, of which COMfNT is a significant 
subset, for (a) national foreign intelligence purposes, (b) counterintelligence purposes, and (c) 
the support of military operations; (2) to conduct information security activities; and (3) to 
conduct operations security training for the U.S. Government. 

13. f T S // SI) Signals intelligence (SIGINT) consists of three subcategories: 

(1) communications intelligence (COMINT); (2) electronic intelligence (ELINT); and (3) foreign 
instrumentation signals intelligence (FISINT). Communications intelligence (COMINT) is 
defined as “all procedures and methods used in the interception of communications and the 
obtaining of information from such communications by other than the intended recipients.” 18 
U.S.C. § 798. COMINT includes information derived from the interception of foreign and 
international communications, such as voice, facsimile, and computer-to- computer information 
conveyed via a number of means | 

Electronic intelligence (ELINT) is technical intelligence information derived from 

foreign non- communications electromagnetic radiations except atomic detonation or radioactive 

sources-in essence, radar systems affiliated with military weapons platforms (e.g., anti-ship) and 

civilian systems (e.g., shipboard and air traffic control radars). Foreign instrumentation signals 

intelligence (FISINT) is derived from non-U. S. aerospace surfaces and subsurface systems which 

may have either military or civilian applications. 
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TOP SECRETY/COMIN'F j J/TSP//ORCON/NOrORN//MR ■ 

14. (S) The NSA’s SIGINT responsibilities include establishing and operating an 
effective unified organization to conduct SIGINT activities set forth in Executive Order No, 
12333, § 1 . 1 2(b), as amended. In performing its SIGINT mission, NSA has developed a 
sophisticated worldwide SIGINT collection network that acquires, among other things, foreign 
and international electronic communications and related information. The technological 
infrastructure that supports the NSA’s foreign intelligence information collection network has 
taken years to develop at a cost of billions of dollars and untold human effort, It relies on 
sophisticated collection and processing technology. 

15. (U) There are two primary reasons for gathering and analyzing foreign 
intelligence information. The first, and most important, is to gain information required to direct 
U.S. resources as necessary to counter external threats. The second reason is to obtain 
information necessary to the formulation of U.S. foreign policy. Foreign intelligence 
information provided by the NSA is thus relevant to a wide range of important issues, including 
military order of battle; threat warnings and readiness; arms proliferation; international terrorism; 
and foreign aspects of international narcotics trafficking. 

1 6. (S) The NSA’s ability to produce foreign intelligence information depends on its 
access to foreign and international electronic communications, Foreign intelligence produced by 
COMINT activities is an extremely important part of tbe overall foreign intelligence information 
available to the United States and is often unobtainable by other means. Public disclosure of 
either the capability to collect specific communications or the substance of the information 
derived from such collection itself can easily alert targets to the vulnerability of their 
communications. Disclosure of even a single communication holds the potential of revealing 
intelligence collection techniques that are applied against targets around the world. Once alerted, 
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targets can frustrate COMINT collection by using different or new encryption techniques, by 

disseminating disinformation, or by utilizing a different communications link. Such evasion 

techniques may inhibit access to the target’s communications and therefore deny the United 

States access to information crucial to the defense of the United States both at home and abroad. 

COMINT is provided special statutory protection under 18 U.S.C. § 798, which makes it a crime 

to knowingly disclose to an unauthorized person classified information “concerning the 

communication intelligence activities of the United States or any foreign government.” 

B. (U) September 11, 2001 and the al Qaeda Threat 

17. (U) On September 1 1, 2001, the al Qaeda terrorist network launched a set of 

coordinated attacks along the East Coast of the United States. Four commercial jetliners, each 

carefully selected to be fully loaded with fuel for a transcontinental flight, were hijacked by al 

Qaeda operatives. Those operatives targeted the Nation’s financial center in New York with two 

of the jetliners, which they deliberately flew into the Twin Towers of the World Trade Center. 

Al Qaeda targeted the headquarters of the Nation’s Armed Forces, the Pentagon, with the third 

jetliner. Al Qaeda operatives were apparently headed toward Washington, D.C. with the fourth 

jetliner when passengers struggled with the hijackers and the plane crashed in Shanksville, 

Pennsylvania. The intended target of this fourth jetliner was most evidently the White House or 

the Capitol, strongly suggesting that al Qaeda’s intended mission was to strike a decapitation 

blow to the Government of the United States — to kill the President, the Vice President, or 

Members of Congress. The attacks of September 1 1 resulted in approximately 3,000 deaths — 

the highest single-day death toll from hostile foreign attacks in the Nation’s history. In addition, 

these attacks shut down air travel in the United States, disrupted the Nation’s financial markets 

and government operations, and caused billions of dollars of damage to the economy. 
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18. (U) On September 14, 2001, the President declared a national emergency “by 



2 reason of the terrorist attacks at the World Trade Center, New York, New York, and the 

3 Pentagon, and the continuing and immediate threat of further attacks on the United States.” 

4 Proclamation No. 7463, 66 Fed. Reg. 48199 (Sept. 14, 2001). The United States also 

5 immediately began plans for a military response directed at al Qaeda's training grounds and 

6 haven in Afghanistan. On September 14, 2001, both Houses of Congress passed a Joint 

7 Resolution authorizing the President “to use all necessary and appropriate force against those 

8 nations, organizations, or persons he determines planned, authorized, committed, or aided the 

9 terrorist attacks” of September 1 1. Authorization for Use of Military Force, Pub. L. No. 107-40 

10 § 21(a), 115 Stat. 224, 224 (Sept. 18, 2001) (“Cong. Auth.”). Congress also expressly 

1 1 acknowledged that the attacks rendered it “necessary and appropriate” for the United States to 

12 exercise its right “to protect United States citizens both at home and abroad,” and acknowledged 

13 in particular that “the President has authority under the Constitution to take action to deter and 

14 prevent acts of international terrorism against the United States.” Id. pmbl. 

15 19. (U) As the President made clear at the time, the attacks of September 1 1 "created 

16 a state of armed conflict.” Military Order, § 1(a), 66 Fed. Reg. 57833, 57833 (Nov. 13, 2001). 

17 Indeed, shortly after the attacks, NATO took the unprecedented step of invoking article 5 of the 

1 8 North Atlantic Treaty, which provides that an “armed attack against one or more of [the parties] 

19 shall be considered an attack against them all." North Atlantic Treaty, Apr. 4, 1949, art. 5, 63 

20 Stat. 2241, 2244, 34 U.N.T.S. 243, 246. The President also determined that al Qaeda terrorists 

21 “possess both the capability and the intention to undertake further terrorist attacks against the 

22 United States that, if not detected and prevented, will cause mass deaths, mass injuries, and 

23 massive destruction of property, and may place at risk the continuity of the operations of the 
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United States Government,” and he concluded that “an extraordinary emergency exists for 
national defense purposes.” Military Order, § 1(c), (g), 66 Fed. Reg. at 57833-34. 

20. (U) As a result of the unprecedented attacks of September 1 1 , 2001, the United 

States found itself immediately propelled into a worldwide war against a network of terrorist 
groups, centered on and affiliated with al Qaeda, that possesses the evolving capability and 
intention of inflicting further catastrophic attacks on the United States. That war is continuing 
today, at home as well as abroad. Moreover, the war against al Qaeda and its allies is a very 
different kind of war, against a very different enemy, than any other war or enemy the Nation has 
previously faced. Al Qaeda and its supporters operate not as a traditional nation-state but as a 
diffuse, decentralized global network of individuals, cells, and loosely associated, often disparate 
groups, that act sometimes in concert, sometimes independently, and sometimes in the United 
Slates, but always in secret — and their mission is to destroy lives and to disrupt a way of life 
through terrorist acts. Al Qaeda works in the shadows; secrecy is essential to al Qaeda’s success 
in plotting and executing its terrorist attacks. 



2 1 . (T S // St/ /Nff ) The In Camera Declaration of Michael McConnell, Director of 
National Intelligence, details the particular facets of the continuing al Qaeda threat and, thus, the 
exigent need for the NS A intelligence activities described here. The NSA activities are directed 




Global telecommunications networks, especially the Internet, have developed in recent years into 

a loosely interconnected system — a network of networks — that is ideally suited for the secret 

communications needs of loosely affiliated terrorist cells. Hundreds of Internet service 
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1 providers, or “ISPs,” and other providers of communications services offer a wide variety of 



2 global communications options, often free of charge 



ESuSulSI 



it erions against at yaeaa ana its arnnates tnererore present critical 



19 challenges for the Nation’s communications intelligence capabilities. First, in this new kind of 

20 war, more than in any other we have ever faced, communications intelligence is essential to our 

21 ability to identify the enemy and to detect and disrupt its plans for further attacks on the United 



IB Mfg.j mnwi 81 



24 CLASSIF1 ED DECLARATION OF LT. GEN. KEITH 8. ALEXANDER 
DIRECTOR, NATIONAL SECURITY AGENCY 
| CASE NO, 07-693; MDL NO. 06-1791 



States. Communications intelligence often is the only means we have to leam the identities of 
particular individuals who are involved in terrorist activities and the existence of particular 
terrorist threats. Second, at the same time that communications intelligence is more important 
than ever, the decentralized, non-hierarch ical nature of the enemy and their sophistication in 
exploiting the agility of modem telecommunications make successful communications 
intelligence more difficult than ever. 

C. (U) NSA Activities Critical to Meeting al Qaeda Threat. 

24. | I 'm /M I M'l II 1 1 1 II | In meet these challenges and to help detect 

and prevent another catastrophic terrorist attack within the United States, the NSA has utilized a 
number of critically important intelligence tools. One such tool was the Terrorist Surveillance 
Program, which the President authorized specifically to detect and prevent al Qaeda-related 
terrorist attacks within the United States. Pursuant the TSP, the NSA was authorized to intercept 
the content 4 of telephone and Internet communications for which there were reasonable grounds 
to believe that (1) such communication originated or terminated outside the United States, and 
(2) a party to such communication was a member or agent of al Qaeda or an affiliated terrorist 
organization. 5 



(TS//SI// T S P//OC/NF) The term “content” is used herein to refer to the substance, 
meaning, or purport of a communication, as defined in 18 U.S.C. § 2510(8), as opposed to the 
type of addressing or routing information referred throughout this declaration as “meta data." 

5 1 1 bri M M'riUl / N h| The TSP was first authorized by the President on 

October 4, 2001, and was reauthorized approximately every 30-60 days throughout the existence 
of the program. The Presidential documents authorizing the TSP also contained the 
authorizations for the meta data activities described herein. The Presidential authorizations, 
moreover, evolved over time, and during certain periods authorized other activities (this 
declaration is not intended to and does not full y describe the President’s authorizations and the 
differences in t 



m 



amera, ax /'arte uassmed Declaration of Lt. Gen. Keith B. Alexander at 
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25. (TS//SI//T S P//OC/NF) On January 10, 2007, the FISA Court issued two orders 
authorizing the Government to conduct certain electronic surveillance that had been occurring 
under the TSP. As explained more fully below, see Section VLB. 5, infra, the orders consisted of 

a| 

and a Foreign Telephone and Email Order, which authorized, 
inter alia , electronic surveillance of telephone and Internet communications carried over 
particularly listed facilities when the Government determines that there is probable cause to 
believe that (1) one of the communicants is a member or agent of al Qaeda or an associated 
terrorist organization, and (2) the communication is to or from a foreign country (i.e., a one-end 
foreign communication to or from the United States). The telephone numbers and email 
addresses to be targeted under the Foreign Telephone and Email Order were further limited to 
those that the NS A reasonably believes are being used by persons outside the United States. 

26. f TS//Siy/T S P//OC/NF ) In light of these intervening FISA Court orders, any 
electronic surveillance that was occurring as part of the TSP is now being conducted subject to 
the approval of the FISA Court, and the President determined not to reauthorize the TSP. As 
described further in Section VLB. 5, infra, and as the United States notified this Court on April 9, 
2007, a Judge of the FISA Court recentl 
declined to adopt the Government’s interpretation of FISA underlying the application for the 
Foreign Telephone and Email Order. The initial authorization to conduct surveillance under the 





1(62, MDLNo. 06-1791-VRW (N.D. CaLHrelatinM^l^ction^eaijisnh^MC^n^Verizon 
Defendants! (submitted Anr. 20. 2007V I 
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1 



Foreign Telephone and Email Order, however, has been extended through May 3 1 , 2007. 
Further proceedings before the FISA Court are ongoing, and the TSP has not been reauthorized. 



27. In addition to the TSP, the NS A also collects 

non-content communication information known as “meta data." Specifically, after the 9/1 1 
attacks, the President authorized the NSA to collect bulk meta data related to telephony 
communications for the purpose of conducting targeted analysis to 

Telephony meta data is information derived from call detail records that reflect non- 
content information such as the date, time, and duration of telephone calls, as well as the phone 
numbers used to place and receive the calls. 

since May 2006 certain telecommunication providers 
have been required by an order of the FISA Court to produce to the NSA on a daily basis all 
telephony meta data that they create (“FISC Telephone Records Order”) 6 Although this 
collection is broad in scope, the NSA queries the data solely with identified telephone numbers 
for which there are facts giving rise to a reasonable, articulable suspicion that the number is 



associated wit 



Historically, only a tiny fraction 



of telephony meta data records collected by the NSA has actually been presented to a trained 



(TS//SI//OC/NF) The FISC Telephone Records Order has been reauthorized 
approximately every 90 days since it was first issued. 



1 1 MM SI9/< H /I N I' 1 1 in before the FISC issued its Telephone Records 

Order, the NSA operated under very similar requirements for accessing the meta data collected 
pursuant to the President’s authorization. 
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professional for analysis. While the vast majority of records are thus never viewed by a human 
at the NSA, it is still necessary to collect the meta data in bulk in order to utilize sophisticated 
analytical tools for tracking the contao 

Telephony meta data collection and analysis are highly valuable tools for tracking 
terrorists and are therefore highly classified and strictly compartmented. 

28. P//OC/NF) In addition, since the 9/1 1 attacks, the NSA 

has collected bulk meta data related to Internet communications. Internet meta data is 
header/router/addressing information, such as the “to,” “from,” “cc,” and “bcc” lines, as opposed 
to the body or “re” lines, of a standard email. The collection of Internet meta data in bulk was 
conducted pursuant to Presidential authorization from October 2001 and since 

July 2004 it has been conducted pursuant to an Order of the Foreign Intelligence Surveillance 
Court authorizing the use of a pen register and trap and trace device (“FISC Pen Register 
Order”)- See 18U.S.C.§3127 (defining “pen register” and “trap and trace device”). Pursuant to 
the FISC Pen Register Order, which has been reauthorized approximately every 90 days since it 
was first issued, the NSA is authorized to collect, in bulk, meta data associated with electronic 
communications on the Internet. 9 




Although the NSA collects email meta data in 
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bulk it is only authorized to query the archived meta data using email 

addresses for which there are facts giving rise to a reasonable, articulable suspicion that the email 
address lar 

in place under the Presidential authorization). As with bulk telephony meta data collection, and 
as the FISA Court specifically recognized in finding the bulk Internet meta data collection 
consistent with the First and Fourth Amendments, the collection of the data in bulk is necessary 
to allow the NSA to use critical and unique analytical capabilities to track the contacts (even 
retrospectively) known terrorists. Like telephony meta data 

activities, Internet meta data collection and analysis are highly valuable tools for protecting the 
United States from attack, and, accordingly, information pertaining to those activities is highly 
classified and strictly compartmented. 
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A. (U) Information that may tend to confirm or deny whether 
the Plaintiffs have been subject to any alleged NSA 
intelligence activity that may be at issue in this matter; and 

B. (U) Information concerning NSA intelligence activities, 
sources, or methods, including: 

(1) (U) Information concerning the scope and operation of 
the Terrorist Surveillance Program, including information 
that may be needed to demonstrate that the TSP was limited 
to one-end foreign al Qaeda-related communications and 
that the NSA does not otherwise engage in the content 
surveillance dragnet that the Plaintiffs allege; and 

(2) (U) Any other information concerning NSA intelligence 
activities, sources, or methods that would be necessary to 
adjudicate the Plaintiffs’ claims, including, to the extent 
applicable, information that would tend to confirm or deny 
whether the NSA collects large quantities of 
communication records information; and 

C. (U) Information that may tend to confirm or deny whether 
Verizon/MCI, AT&T, or any other telecommunications 
carrier has assisted the NSA with the alleged intelligence 
activities. 

VI. (U) Description of Information Subject to Privilege and the Barm of Disclosure 

A. (U) Information That May Tend to Confirm or Deny Whether the Plaintiffs Have 
Been Subject to Any Alleged NSA Activities That May Be at Issue in This Matter 

32. (U) The first category of information as to which I am supporting the DNI’s 

assertion of privilege, and asserting the NSA’s own statutory privilege, concerns information as 

to whether particular individuals, including the named Plaintiffs in this lawsuit, have been 

subject to alleged NSA intelligence activities. As set forth below, confirmation or denial of such 

information would cause exceptionally grave harm to national security. 
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33. (T S // 6 I//T S P//0 C/N - F ) The named Plaintiffs in this action — Virginia Shubert, 

Noha Arafa, Sarah Dranoff, and Hilary Botein — allege that the contents oftheir telephone and 
Internet communications were subject to “unlawful interception, search and seizure, and 
electronic surveillance,” Amended Cornpl. If 87, in connection with a program of “dragnet” 
surveillance that captures the contents of ‘Virtually every telephone, internet and/or email 
communication that has been sent from or received within the United States since 2001 



id. Iffl 1,4. The NS A does not engage in the “dragnet” program that Plaintiffs allege, 
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3. (U) Harm of Disclosure 




or deny whether any individual is subject to the surveillance activities described herein, because 
to do so would tend to reveal actual targets. For example, if the NSA were to confirm in this 
case and others that specific individuals are not targets of surveillance, but later refuse to 
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comment (as it would have to) in a case involving an actual target, a person could easily deduce 
by comparing such responses that the person in the latter case is a target. The harm of revealing 
targets of foreign intelligence surveillance should be obvious, If an individual knows or suspects 
he is a target of U.S. intelligence activities, he would naturally tend to alter his behavior to take 
new precautions against surveillance. !•' '' ' : ■ >V ' V • • • / -i 

addition, revealing 

who is not a target would indicate who has avoided surveillance and who may be a secure 
channel for communication. Such information could lead a person, secure in the knowledge that 
he is not under surveillance, to help a hostile foreign adversary convey information; 
alternatively, such a person may be unwittingly utilized or even forced to convey information 
through a secure channel. Revealing which channels are free from surveillance and which are 
not would also reveal sensitive intelligence methods and thereby could help any adversary evade 
detection. 
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37. | I 'i I 1 I 'III I 1 II I Disclosing any of this information would reveal 

some of the Nation’s most sensitive and important intelligence-gathering methods. For reasons 
already discussed, such disclosures would cause exceptionally grave damage to the national 
security by allowing al Qaeda and its affiliates to evade detection, as well as by alerting other 
foreign adversaries to these critical intelligence- gathering methods, Disclosing whether the NS A 
currently receives telephony or Internet meta data also 

violate specific provisions of the FISC Telephone Records and FISC Pen Register Orders. 

B. (TJ) Information Concerning NSA Activities, Sources, or Methods, and the Harm of 

Disclosure. 

38. (TJ) The second category of information over which I am supporting the DNI’s 
assertion of privilege and asserting the NSA’s statutory privilege is information concerning NSA 
intelligence activities, sources, and methods that may at issue in this case, including (1) facts 
concerning the operation of the Terrorist Surveillance Program and any other NSA intelligence 
activities needed to demonstrate that the TSP was limited as the President stated to the 
interception of one-end foreign communications reasonably believed to involve a member or 
agent of al Qaeda or an affiliated terrorist organization, see H 24 & n.5, supra, and that the NSA 
does not otherwise conduct a dragnet of content surveillance as the Plaintiffs allege; (2) other 
classified facts about the operation of the TSP that would be necessary to adjudicate the 
lawfulness of that program; and (3) facts that would confirm or deny whether the NSA collects 
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large quantities of communication records information. As set forth below, the disclosure of 
such information would cause exceptionally grave harm to national security. 

1. (U) Information Concerning Plaintiffs’ Allegations of a Content Surveillance 

“Dragnet.” 

39. (U) In December 2005, President Bush explained that,- after the September 1 1 
attacks, he authorized the NS A to intercept the content of certain communications for which 
there are reasonable grounds to believe that (1) such communication originated or terminated 
outside the United States, and (2) a party to such communication is a member or agent of al 
Qaeda or an affiliated terrorist organization. The President stated at the time that this activity, 
now referred to as the Terrorist Surveillance Program, did not involve the collection of purely 
domestic communications, or international communications with no al Qaeda connection, and 
these facts were reiterated publicly by the Attorney General and then- Deputy Director of 
National Intelligence. Nonetheless, I am advised that the Plaintiffs have alleged that, pursuant to 
a secret NS A program, “virtually every telephone, internet and/or email communication that has 
been sent from or received within the United States since 2001 has been (and continues to be) 
searched, seized, intercepted, and subjected to surveillance without a warrant, court order or any 
other lawful authorization.” Amended Compl. U 1. As the President made clear in describing the 
limited scope of the TSP, such allegations of a content surveillance dragnet are false. But if the 
NSA had to demonstrate in this case that the TSP was limited as the President stated, and not a 
dragnet as the Plaintiffs claim, and that the NSA does not otherwise engage in the dragnet that 
Plaintiffs allege, sensitive and classified facts about the operation of the TSP and NSA 
intelligence activities would have to be disclosed. 

40. (¥ S//SI//TSP//OC/NF ) The privileged information that must be protected from 



disclosure includes the following classified details demonstrating the limited nature of the TSP. 
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1 First, interception of the content of communications under the TSP was triggered by a range of 

2 information, including sensitive foreign intelligence, obtained or derived from various sources 

3 indicating that a particular phone number or email address is reasonably believed by the U.S. 

4 Intelligence Community to be associated with a member or agent of al Qaeda or an affiliated 

5 terrorist organization. Professional intelligence officers at the NSA undertook a careful but 

6 expeditious analysis of that information, and considered a number of possible factors, in 

7 determining whether it would be appropriate to target a telephone number or email address under 

8 the TSP. Those factors included whether the target phone number or email address was: 

9 (1) reasonably believed by the U.S. Intelligence Community, based on other authorized 

1 0 collection activities or other law enforcement or intelligence sources, to be used by a member or 



1 1 agent of al Qaeda or an affiliated terrorist organization; 
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4 1 . (T S // S I//T S P//OC/NF) Once the NS A determined that there were reasonable 
grounds to believe that the target is a member or agent of al Qaeda or an affiliated terrorist 
organization, the NS A took steps to focus the interception on the specific al Qaeda- related target 
and on communications of that target that are to or from a foreign country. In this respect, the 
NSA’s efforts the NSA 

reasonable grounds to believe carry the “one end” foreign communications of members or agents 
of al Qaeda or affiliated terrorist organizations. 

42 . 
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NSA took specific steps in the actual TSP 



6 interception process to minimize the risk that the communications of non-targets were 

7 intercepted. With respect to telephone communications, specific telephone numbers identified 



8 through the analysis outlined above were 



so that the only communications 



1 0 intercepted were those to or from the targeted number of an individual who was reasonably 

1 1 believed to be a member or agent of al Qaeda or an affiliated terrorist organization. For Internet 

12 communications, the NSA used identifying information obtained through its analysis of the 



1 3 target, such as email addresses 



to target for collection the communications of 



1 4 individuals reasonably believed to be members or agents of al Qaeda or an affiliated terrorist 

15 organization. 16 



At no did the NSA search the 

1 9 content of the communications^^^^^^^^^^^^lwith “key words” other than the targeted 
selector^hemselve^ Rather, the NSA targeted for collection only email addresses 

20 ^J^^f^H^^Hassociated with suspected members o^aent^niHDaeda or a 

leoonstorgainzanons, or communications in which such ere mentioned. 

21 In addition, due to technical limitations of the hardware an^oftwai^urrently used, incidental 
collection of non-target communications has occurred, and in such circumstances the NSA 

22 applies its minimization procedures to ensure that communications of non-targets are not 
disseminated. To the extent such facts would be necessary to dispel Plaintiffs’ erroneous dragnet 

23 allegations, they could not be disclosed without revealing highly sensitive intelligence methods. 
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17 (U /FOUQ ) In addition, in implementing the TSP, the NS A applied the existing Legal 
Compliance and Minimization Procedures applicable to U.S. persons to the extent not 
inconsistent with the President's authorization. See United States Signals Intelligence Directive 
(USSID) 18. These procedures require that the NSA refrain from intentionally acquiring the 
communications of U.S. persons who are not the targets of its surveillance activities, that it 
destroy upon recognition any communications solely between or among persons in the U.S. that 
it inadvertently acquires, and that it refrain from identifying U.S. persons in its intelligence 
reports unless a seruor NSA official determines that the recipient of the report requires such 
information in order to perform a lawful function assigned to it and the identity of the U.S. 
person is necessary to understand the foreign intelligence or to assess its significance. 
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49. ( T S //SI//TSP//OC/NF) For example, in conjunction with meta data analysis, the 
TSP provided far greater operational swiftness and effectiveness for identifying the al Qaeda 
terrorist network in the United States than the traditional procedures that had been used under the 
Foreign Intelligence Surveillance Act. In order to ascertain as rapidly as possible the potential al 
Qaeda terrorist threats facing the United States, the NSA must know not only what a foreign 
terrorist target says in a particular telephone or Internet intercept, but with whom that person has 
been communicating. To the extent individual court orders for all TSP targets could have been 
required in advance under traditional FISA procedures, the NSA would have been unable to 
target communications sent to and from new phone numbers or Internet accounts as quickly, and 
valuable intelligence could have been lost. 



50. (T S // S I//T S P//OC/NF) As noted, 




ie TSP, in conjunction with meta data collection and analysis 
allowed the NSA to obtain rapidly not only the content of a particular communication, but 
connections between that target and others who may form a web of al Qaeda conspirators. In 
some cases, the NSA was able to begin collection on a target phone number in | 

to begin collection on a targeted phone number or 
email address. In contrast, if individual applications have to be prepared and approved through 
the traditional FISA process before the NSA can target a newly identified phone number or email 
account associated with al Qaeda, vital information could be lost in the interim. The traditional 
FISA process is a highly effective tool for many types of surveillance activities,] 
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to stop and demonstrate, through a multi-layered process involving NSA and DOJ counsel, the 
Attorney General, and the FISA Court, that each of numerous, rapidly changing target numbers 
or emails requires coverage. Where the gravest of dangers are at stake — a catastrophic mass 
casualty terrorist attack against the U.S. Homeland and the corresponding need to track 
thousands of potential terrorists — and where 

to hide their communications and tracks, it is vital that the NSA be able to track multiple 
communications, contacts, and as rapidly as possible to fulfill its mission to protect the 

national security of the United States. 

51 . (TS//SI//TSF//OC/NF) None of the foregoing information about the Terrorist 
Surveillance Program could be disclosed in this case, however, without causing exceptionally 
grave harm to the national security. Even though the President has determined not to reauthorize 
the TSP, revealing how the program operated would provide key insights to foreign adversaries 
as to how the NSA monitors communications. Information about the specific foreign 
intelligence factors that triggered interception under the TSP would obviously reveal to foreign 
adversaries the very facts that would most likely lead to their communications being intercepted, 
even under the current FISA Court Orders, thereby giving adversaries a roadmap as to how to 
avoid such interception. 
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52. (TS// S 1//T S P//OC/NF) Likewise, information about the speed and agility with 
which the NS A can collect content on a target, and how long it might maintain surveillance, 
would provide invaluable insights for an adversary to devise new and different ways to protect 
their communications. In particular, disclosure of the NSA’s ability to utilize the TSP (or, 
therefore, the current FISA Court-authorized content collection) in conjunction with contact 




method of surveillance, even no longer in use, can easily lead to evasive actions as to other 
current methods that would deprive U.S. decision-makers of critical information needed to detect 




3. (S-) Information Concerning Meta Data Activities 

53. 1 1 'i V i ll HI > In the extent that the NSA’s bulk collection and 

targeted analysis of communication meta data may be at issue in this case, those activities — as 
described in paragraphs 27 and 28, above — must also be protected from disclosure. 

54. ( I hWJ H /INI' | A 1 noted above, starting in October 2001, and now 

pursuant to the FISC Pen Register Order, the NSA collected bulk meta data associated with 
electronic communications I 
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9/1 1 Commission report, when Khalid al-Mihdhar, one of the 9/1 1 hijackers, was in the United 
States from January 2000 to June 2001, he telephoned the home of his wife’s family in Yemen. 
The phone number for this home in Yemen had well-established terrorist connections 19 and was 
being targeted by the NSA through an overseas collection process that did not have the capability 
to obtain meta data to help identify the location of incoming calls. At the time, there was no 
FISA collection on this number, and neither the TSP program, under which the NSA targeted 
one-end foreign calls into the United States, nor the collection of bulk meta data, which would 
have allowed analysis of this number to ascertain other contact numbers, were in place. Had the 
Yemeni phone number been targeted using the TSP and were meta data analysis available, we 
should have been able to identify that al-Mihdhar was in the United States when he called the 
number in Yemen, which would have provided leads to investigate the matter further. Indeed, 
the 9/1 1 Commission report noted that if the FBI had known that al Mihdhar was in the United 
States, “investigations or interrogation of [al Mihdhar], and investigation of [his] travel and 
financial activities could have yielded evidence of connections to other participants in the 9/1 1 
plot. The simple fact of [his] detention could have derailed the plan. In any case, the 
opportunity did not arise.” Final Report of the National Commission on Terrorist Attacks Upon 
the United States (“9/1 1 Commission Report”) at 272. While there is an element of hindsight to 
this example, and perhaps other actions could have detected al Mihdhar, the existence of the TSP 
and meta data activities would have provided a highly significant tool that may have proved 
valuable in detecting the 9/1 1 plot. 



19 

would-be 



(T S //SI// N F ) In August 1998, the number was found in the pocket of one of the 
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59. t Ti I'll') Based on my experience as Director of the 

NS A, I believe that the meta data collection activities authorized by the President after 9/1 1 and 
subsequently authorized by the FISC are among the most important intelligence tools available 
to the United States for protecting the Homeland from another catastrophic terrorist attack. In 
my view, the NSA could not have obtained certain critical intelligence in any other way. These 
NSA activities have given the United States unparalleled ability to understand 

If employed on a sufficient volume of raw data. 



contact chaimn 



can expose 



and contacts that 



„ were previously unknown. Meta data collection thus enables the NSA to segregate some of that 

1 0 very small amount of otherwise undetectable but highly valuable information from the 



1 overwhelming amount of other information that has no intelligence value whatsoever — in 
colloquial terms, to find at least some of the needles hidden in the haystack. 












i v a v v vy i ^ 



of telephony meta data would confirm to all of our foreign adversaries 

he existence of these critical intelligence capabilities and thereby severely undermine 
NS A’s ability to gather information concerning terrorist connections. 

4. (T S // S I//TSP//QC/NF ) Information Demonstrating the Success of the 
TSP and Meta Data Activities. 

60. (T S // S D/T SPtf9 €/N F) Specific examples of how the TSP, in conjunction with 

meta data analysis, led to the development by the NSA of actionable intelligence and important 
counter-terrorism efforts help illustrate the effectiveness and need for the activities. To the 
extent that such examples would be relevant to any defense of this action, however, those 
examples could not be disclosed without revealing specific NSA intelligence information, 
sources, and methods. For instance: 



s a result of contact chaining undertaken pursuant 



to meta data analysis, the NSA was able to discover contacts betweei 
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61 . ■ (T S // S I//T S P/ZO C/N F) Information about any of the successes of NSA activities 
would not only be revealing of the substantive knowledge of the United States Government as to 
terrorist plans and activities, but would also tend to reveal or confirm to all of out foreign 
adversaries the sources and methods by which the United States obtained such information. 

5. (€) Information Concerning FISC Orders. 

62. to the extent relevant to the litigation ot 
this case, information concerning the various orders of the Foreign Intelligence Surveillance 
Court mentioned throughout this declaration must also remain protected from public disclosure. 
As discussed above, three NSA intelligence activities authorized by the President after the 
September 1 1 attacks to detect and prevent a further al Qaeda attack — the TSP, Internet meta 
data collection, and telephony meta data collection — have been subject to various orders of the 
FISC and are no longer being conducted under Presidential authorization. The very existence of 
the meta data FISC orders — the FISC Pen Register Order (first issued in July 2004) and the FISC 
Telephone Records Order (first issued in May 2006) — remains classified. The President 
authorized the disclosure of the general existence of the January 10, 2007 FISC orders that 
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authorized electronic surveillance of 



individuals in a manner similar to that 



undertaken in the TSP, and President’s authorization of the TSP lapsed in February 2007. 
Information that may reveal the existence of the undisclosed FISC orders or the substance of any 
of these orders should be protected from disclosure. 



Disclosure of information about and within the 



FISC orders would obviously reveal intelligence sources and methods currently being utilized by 
the NS A under Court order and, thus, would cause exceptional harm to national security. For 

8 example, as discussed above, the FISC Telephone Records Order requires certain 

9 telecommunication companies to produce all of their telephony meta data to the NSA on a daily 

1 0 basis and authorizes the NSA to access its archive of collected telephony meta data only when 

1 1 the NSA has identified a known telephone number reasonably suspected to be associated with 

The Order also provides that a telephone number 



1 3 believed to be used by a U.S. person shall not be regarded as associated with 

solely on the basis of activities that are protected by the First 
15 II Amendment. The FISC Pen Register Order authorizes the use of a pen register and trap and 



1 6 trace device to collect Internet meta data 



on similar 



1 7 terms. Disclosure of these facts would reveal sensitive sources and methods utilized by the NSA 



1 8 to obtain data utilized to track 



ntacts of 



( I M hNI'i For this reason, the FISC Telephone Records Order and 

20 FISC Pen Register Ord^^^OTiibit any person from disclosing to any other person that the NSA 
has sought or obtained the telephony meta data, other than to (a) those persons to whom 

2 1 disclosure is necessary to comply with the Order; (b) an attorney to obtain legal advice or 
assistance with respect to the production of meta data in response to the Order; or (c) other 

22 persons as permitted by the Director of the FBI or the Director’s designee. The FISC Orders 
further provide that any person to whom disclosure is made pursuant to (a), (b), or (c) shall be 

23 subject to the nondisclosure requirements applicable to a person to whom the Order is directed in 
the same manner as such person. 
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64. (TS//Sl l 



| /T SPfl ORCON/NOFOR N//MR 
f /OC//NF) The intelligence activities authorized by the FISC 
Pen Register and FISC Telephone Records Orders must not be compromised by the disclosure ofj 
other information. For example, as discussed above, the disclosure of 






Thus, any attempt to address the lawfulness of the meta data activities under Presidential 
authorization prior to the FISC orders would directly risk disclosure of current NSA operations 
under FISC Orders. 



65 . 1 1 1 1 M'ni H I'll 1 1 The disclosure of information concerning the 

recent FISC Orders authorizing electronic surveillance would also harm national security. The 
January ] 0, 2007 Foreign Telephone and Email Order authorized, among other things, electronic 
surveillance of telephone and Internet communications | 

when the Government determines that there is probable cause to believe that (1) one of the 
communicants a member or 

the communication is to or from a foreign country, i.e., a one-end foreign communication to or 
from the United States. 21 The telephone numbers and email addresses to be targeted (i.e. , 
“selectors”) under this order were further limited to those that the NSA reasonably believes are 
being used by persons outside the United States. Under the order, every 30 days the Government 
is required to submit a report to the FISA Court listing new selectors that the NSA has targeted 




the other details in the orders, highly classified. 
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during the previous 30 days and briefly summarizing the basis for the NSA’s determination that 
the probable cause standard has been met. 

66. (TS//SI//OC//IVF) The surveillance under this new FISA Court Foreign 
Telephone and Email Order, which is subject to detailed minimization and oversight procedures, 
was authorized for 90 days and indicated that it may be reauthorized by the FISA Court upon 
application by the Attorney General. The order states that, with each request for reauthorization, 
the Government is required to present a list of current selectors previously reported to the FISA 
Court that the Government intends to continue to task for collection under the reauthorization. 
The order further indicated that, at any time, the FISA Court may request additional information 
regarding particular selectors, and, if the Court finds that the applicable probable cause standard 
is not met, jt may direct that the surveillance under the order shall cease on the selector(s) in 
question. This non-traditiona) order allowed the Government to target for collection 



communications related to new 



selectors used by terrorists without 



having to seek advance approval from the FISA Court for each individual selector. Upon the 
initiation of the surveillance authorized under the Foreign Telephone and Email Order, the NSA 



monitored ovi 



breign selectors. 



the reporting of these initial 



selectors occurred over a 90-day period. 






1 












2 



3 ^^^^^^^^^^Jhowever, did not grant the Government’s application to renew the 

4 surveillance authority in the Foreign Telephone and Email Order (concerning surveillance 

5 targeting telephone numbers and e-mail addresses reasonably believed to be used by persons 

6 outside the United States). Rather, it issued an Order and Memorandum opinion on April 3, 

7 2007, declining to adopt the interpretation of the Foreign Intelligence Surveillance Act 

8 underlying the Government’s application for the Foreign Telephone and Email Order. The Court 

9 nevertheless ordered that the Government could submit an application for a single extension of 

1 0 the Foreign Telephone and Email Order to May 31, 2007. The Court contemplated that an 

1 1 extension of surveillance authority to May 3 1 would allow the Government to submit an 

12 application that might permit the Court ‘ho authorize at least part of the [requested] surveillance 

13 in a manner consistent with [its] order and opinion." On the Government’s application, the 

14 Court granted a separate order issued on April 5, 2007, extending the surveillance authority 

1 5 granted by the Foreign Telephone and Email Order to May 3 1 , 2007. 

1 6 69. (T S //S I//0 C//KF) The Government has reviewed the new FISA Court orders and 

17 is working closely with the FISA Court in the hopes of developing an approach for continuing 

1 8 the authorized surveillance beyond May 3 1 , 2007, in a manner consistent with the April 3 , 2007, 

19 order of the FISA Court. The details of these orders, and targets implicated by the orders, like 

20 the operational details and targets of the ongoing FISA Court-approved surveillance, are highly 

21 classified. Thus, information about the nature of these recent FISC orders should not be 

22 disclosed in this case. 

23 
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C. (U) Information That May Tend to Confirm or Deny Whether Verizon/MCI and/or 
AT&T Has Assisted the NSA with the Alleged Intelligence Activities 

70. (U) The third major category of information as to which I am supporting the 

DNI’s assertion of privilege, and asserting the NSA’s statutory privilege, concerns information 

that may tend to confirm or deny whether Verizon/MCI and/or AT&T has assisted the NSA with 

the alleged intelligence activities. As set forth below, confirmation or denial of such information 

would cause exceptionally grave harm to national security. 



Plaintiffs allege that they are customers of 



Verizon and/or AT&T, and that those companies participate in the content surveillance dragnet 
that Plaintiff's allege. See Amended Compl. 5-8. Neither company has participated in the 



alleged dragnet, because such a program does not exist. 
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VII . (U) Risks of Allowing Litigation to Proceed 



82. 1 1 hi'i ll il M I'll! 1 1 1 mi i examination of the allegations, claims, facts, 

and issues raised by this case, it is my judgment that sensitive state secrets are so central to the 
subject matter of the litigation that any attempt to proceed will substantially risk the disclosure or 
the privileged state secrets described above. Although Plaintiffs challenge an alleged content 
surveillance dragnet that does not exist, proving why that is so 



would directly implicate highly classified 




effort to probe the outer-bounds of such classified information would pose inherent and 
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significant risks of the disclosure of that informa tion, including criti cally sensitive information 
about NS A sources, methods, operations, targets^^^^^^^^^J 

83. (S-) Indeed, any effort merely to allude to those facts in a non-classified fashion 
could be revealing of classified details that should not be disclosed. As noted, even seemingly 
minor or innocuous facts, in the context of this case or other non-classified information, can tend 
to reveal, particularly to sophisticated foreign adversaries, a much bigger picture of U.S. 
intelligence gathering sources and methods. 

VIII. (U) Summary and Conclusion 

84. (T S// S I//K F) The United States has an overwhelming interest in detecting and 
thwarting further mass casualty attacks by al Qaeda. The United States has already suffered one 
attack that killed thousands, disrupted the Nation’s financial center for days, and successfully 
struck at the command and control center for the Nation’s military. Al Qaeda continues to 
possess the ability and clear, stated intent to carry out a massive attack in the United States that 
could result in a significant loss of life, as well as have a devastating impact on the U.S. 
economy. According to the most recent intelligence analysis-, attacking the U.S. Homeland 
remains one of al Qaeda’s top operational priorities, see In Camera Declaration of Michael 
McConnell, DNI, and al Qaeda will keep trying for high-impact attacks as long as its central 
command structure is functioning and affiliated groups are capable of furthering its interests. 

85. (TS//SI//NF) Al Qaeda seeks to use our own communications infrastructure 

against us as they secretly attempt to infiltrate agents into the United States, waiting to attack at a 

time of their choosing. One of the greatest challenges the United States confronts in the ongoing 

effort to prevent another catastrophic terrorist attack against the Homeland is the critical need to 

gather intelligence quickly and effectively. Time is of the essence in preventing terrorist attacks, 
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and the government faces significant obstacles in finding and tracking agents of al Qaeda as they 
manipulate modem technology in an attempt to communicate while remaining undetected. The 
NS A activities described herein are vital tools in this effort. 

86. (S) For the foregoing reasons, in my judgment the disclosure of the information 

discussed herein would cause exceptionally grave damage to the national security of the United 
States. In addition to upholding the state secrets privilege and statutory privilege assertions by 
the Director of National Intelligence in this case, I request that the Court also uphold my 
assertion of NSA’s statutory privilege to protect information about NSA activities. Finally, it is 
my view that continued litigation of this lawsuit would risk the disclosure of sensitive classified 
information and, accordingly, that the Court should not only protect from disclosure the 
classified information described herein but dismiss this lawsuit. 



1 declare under penalty of perjury that the foregoing is true and correct. 



I DATE: 






LT. GEN. KEITH B. ALEXANDER 
Director, National Security Agency 
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